CVE-2025-40549: A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to…
CVE-2025-40549 · Severity: critical · CVSS 9.1 · Published 2025-11-18
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory.
This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.
No. Junglewise Threat Intelligence has no report of CVE-2025-40549 being exploited in the wild.
How severe is CVE-2025-40549?
Critical severity, with a CVSS score of 9.1, published 18 November 2025.
Which products and versions are affected?
SolarWinds Serv-U. The advisory does not name versions.
Is there a fix for CVE-2025-40549?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-40549?
Check whether you run SolarWinds Serv-U. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.